Coherent State Quantum Key Distribution with 
Multi Letter Phase-Shift Keying 



Denis Sych and Gerd Leuchs 

Max Planck Institut fiir die Physik des Lichts, Gunther-Scharowsky-Strasse 1 / 
Bau24, D-91058 Erlangen, Germany 

Institut fiir Optik, Information und Photonik, Universitat Erlangen-Niirnberg, 
Staudtstrasse 7 / B2, 91058 Erlangen, Germany 

Abstract. We present a protocol for quantum key distribution using discrete 
modulation of coherent states of light. Information is encoded in the variable phase of 
coherent states which can be chosen from a regular discrete set ranging from binary 
to continuous modulation, similar to phase-shift-keying in classical communication. 
Information is decoded by simultaneous homodyne measurement of both quadratures 
and requires no active choice of basis. The protocol utilizes either direct or reverse 
reconciliation, both with and without postselection. We analyze the security of the 
protocol and show how to enhance it by the optimal choice of all variable parameters 
of the quantum signal. 



PACS numbers: 03.67.Dd, 42.50.Ex, 89.70.Cf 
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1. Introduction 

Quantum key distribution (QKD) is a procedure of information exchange between two 
parties, the sender Ahee and the receiver Bob, which allows to distribute absolutely 
secure data between them (Gisin et al. 2002, Dusek et al. 2006, Scarani et al. 2009). 
The distinctive part of QKD with respect to classical communication is the use of 
a quantum information channel, where the signal is protected from unauthorized 
duphcation (Woofers k Zurek 1982, Dieks 1982, Bennett k Brassard 1984, Ekert 1991). 
Mathematically, the information signal can be described by discrete variables (DV) or 
by continuous variables (CV) (Cerf et al. 2007), although physically the signal can 
be of various kinds: single photons (Bennett k Brassard 1984), weak coherent pulses 
(Bennett 1992), squeezed states (Ralph 1999, Hillery 2000) and other systems where a 
signal possesses essentially quantum properties. 

A universal characteristic that can be compared for different QKD protocols (apart 
from their experimental realizations) is the secret key generation rate (shortly, key 
rate) — i.e. the average amount of secure information per elementary transmission 
(e.g. per light pulse). In order to transmit higher total amount of secure data one 
can increase the pulse repetition rate or increase the key rate. The first way is limited 
mainly by experimental techniques, while the second one is defined by mathematical 
properties of the given QKD protocol. 

In the case of DV QKD, it has been shown that extensions of the standard 
four-letter BB84 protocol (Bennett & Brassard 1984) to higher number of letters 
in the alphabet can improve performance in terms of higher critical error rate or 
longer communication hues (BruB 1998, Bechmann-Pasquinucci & Gisin 1999, Sych 
et al. 2004, Sych et al. 2005). 

In the case of CV QKD, the first protocols were based on Gaussian alphabets 
consisting of either coherent or squeezed states. The common weak point of these 
protocols is high sensitivity to losses in the quantum communication channel, which 
initially was believed to lead to the so-called "3 dB loss limit": the key rate is equal 
to zero when channel losses are higher than 50%. After the invention of postselection 
(Silberhorn et al. 2002) and reverse reconciliation (Grosshans et al. 2003), this limit was 
overcome, and the key rate was substantially improved. Another interesting option for 
improving the key rate is to consider discrete alphabets (Namiki & Hirano 2003, Held k 
Liitkenhaus 2006) instead of Gaussian ones. Protocols with Gaussian alphabets have an 
advantage of simpler security analysis, whilst the protocols based on discrete modulation 
are easier to realize in practice. 

In this work we address the question how one can further increase the key rate of 
CV QKD with discrete modulation by varying the geometry of the quantum alphabet. 
Having in mind the idea of improving the properties of DV QKD by use of more 
symmetric alphabets with higher number of letters (Sych et al. 2005), we present a new 
CV QKD protocol which generalizes previous ones with discrete modulation (Namiki 
k Hirano 2003, Lorenz et al. 2004, Held k Liitkenhaus 2006). Namely, the protocol 
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employs an alphabet with coherent states \ak) 



■ 2ir 1 



which have relative phases 



^/c and a fixed amplitude a. In classical communication, this type of encoding is known 
as phase-shift-keying (PSK). We perform a security analysis of the proposed protocol 
for lossy but noiseless quantum channels, providing full optimization of all parameters 
of the protocol, and show how the number of letters affects the key rate. 



2. Description of the protocol 

An elementary information transmission in the multi letter PSK protocol is as follows: 

• The sender (Alice) chooses a random equiprobable number k = 1 . . . N and sends 
the respective coherent state \ak) = ae^~^^. 

• The receiver (Bob) measures the state by splitting the signal at a 50/50 beam 
sphtter and measuring two conjugate quadratures x and p at the output ports by 
homodyning each signal — such a scheme is called heterodyne measurement (Lorenz 
et al. 2004, Weedbrook et al. 2004), where the two conjugate measurements can be 
separated in time or space. The results of the measurements are (3x and /3p, which 
we write as a pure coherent state \f3) = \(3x + iPp)- 

• Bob assigns a classical number / to the measured state \(3) by finding a state \ai) 
which is the closest alphabet's state to the state | {ai\ [3) p = max | [3) p. 

n 

Generally speaking, this classical value / decoded by Bob can be different from the 
initial value k sent by Alice because of intrinsic quantum uncertainty even in the 
absence of eavesdropping or any channel noise. 

The elementary information transmission from Alice to Bob can be schematically shown 
clS cl "fc — > /" channel: 

, encoding , , measurement , r,\ decoding , , 

k — > \ak) — > 1/3) — > I. (1) 

As long as the considered quantum alphabet has a regular 2t^/N phase-shift 
symmetry, and all states have an equal probability to be sent, all channel inputs and 
outputs ([T]) are equiprobable. We note, that there is no active choice of measurement 
basis in our protocol, therefore there is no basis reconciliation needed. All transmissions 
contribute to the total secure key, and nothing is discarded unlike in previous protocols 
with discrete modulation and homodyne detection (Namiki & Hirano 2006). 

After the measurement. Bob can (but not necessarily has to) use the postselection 
idea (Silberhorn et al. 2002), when he decides whether to keep the transmission 
depending on the value (5. The elementary transmission ([1]), possibly followed by 
postselection, is repeated until Alice and Bob collect enough data to perform classical 
error correction and privacy amplification procedures (Gisin et al. 2002). The resulting 
data is a secret key. 

The amplitude a and the number of letters N can be fiexibly adjusted for a given 
information channel. The exact optimization for a given channel transmittance will be 
discussed later. These parameters are supposed to be publicly known, particularly by 



Coherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying 



4 



the potential eavesdropper. We note that the number of states can be arbitrary large. In 
the limit of infinity N oo we have a continuous phase modulation. Thus our protocol 
can be viewed as a smooth transition between discrete (Namiki & Hirano 2003, Lorenz 
et al. 2004, Heid & Liitkenhaus 2006) and continuous (Silberhorn et al. 2002, Grosshans 
& Grangier 2002, Weedbrook et al. 2004) modulation of CV. 

3. Security analysis 

We investigate the security of our protocol assuming there is no excess noise in the 
quantum channel. In this case the best possible attack is the beam splitting attack 
(Heid & Liitkenhaus 2006). We allow Eve to have unlimited access to all the losses, as 
she could replace the real lossy information channel with an ideal lossless one. 

The beam splitting transformation is |afc)^ — > lA)^ ® kfc)^) where Alice's initial 
state \ak) is split to Bob's state |/3fc) and Eve's state |efc): 



and rj is the channel transmittance. 

In this beam splitting scenario. Eve does not introduce any excess noise on Bob's 
side, whereas in any other better eavesdropping strategy Eve necessarily does. For 
example, if Eve would make an intercept-resend attack, then she adds at least one unit 
of shot noise. Afterwards, she can attenuate the signal, and the excess noise will be 
proportionally reduced. As a remark on the side, we see in this way, that the maximum 
tolerable excess noise cannot exceed that of the intercept-resend strategy, i.e. cannot 
be higher then channel transmittance rj. 

In real communication lines, such as optical fibres or free space, excess noise 
(typically, about 1% of shot noise (Lorenz et al. 2004, Lorenz et al. 2006, Elser 
et al. 2008)) is introduced mainly by imperfections of the experimental setup, and there 
is almost no measurable excess noise due to the channel itself. If the absence of channel 
excess noise is experimentally verified, then the eavesdropping strategy based on beam 
splitting is the best possible attack, at least for the values of the channel transmittance 
7] > 0.01. 

3.1. Information between Alice and Bob 

The amount of classical mutual Shannon information I^b transmitted from Alice to 
Bob via the channel ([T]) is equal to the difference of a priori (before measurement) and 
a posteriori (after measurement) entropies (Shannon 1948). Before any measurement, 
all channel outcomes are equiprobable for Bob, so his a priori entropy -f^^"^'^ is the 
unconditional "pure guess" entropy equal to logg bit per transmission. 

The conditional probability density to measure the state \(3) when a state \ak) has 
been sent is p{(3\k) ~ | {(3k\ P) P ~ e~l^~^''l^ The total unconditional probability density 




(2) 



Coherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying 



5 



N 

to measure a state \[3) is = p[(5\k). Its normalization J p{P)dp = 1 also yields 

k=l 

the normalization of p{P\k) = ie~'^~^'-'l . 

After the measurement of the probability that the state la^) was initially 
sent is 

As we discussed above, the measured state \P) is decoded by Bob to a classical value 
I such that the state \ai) is the closest alphabet's state to the measured state 
Corresponding regions in the phase space are shown by different shades of grey in Fig. [H 
In the case when / = k the value ([3]) is the probability of decoding the correct result, 
otherwise ([3]) is the error probability of decoding a wrong result / 7^ k. 

Bob's a posteriori entropy H^^j^ is the Shannon entropy of the total probability 
distribution = {pi{P) , P2{P) , ■ ■ ■ ,Pn{i3)} conditioned on the measured state 

N 

HZl[pm = - E^'^(^) iog2P.(/5). (4) 
fc=i 

Finally, the amount of classical information transmitted from Alice to Bob via the 
channel ([1]): 



p{P)iABmp, (5) 



N 

where = \og^ N + pk{(3) \og^ Pk{f3). 

k=l 

3.2. Eve's information 

To calculate Eve's potential information we consider two strategies of classical 
communication between Alice and Bob during the post processing step: direct 
reconciliation and reverse reconciliation. In the first strategy Alice sends correcting 
information to Bob, and in the second one Bob sends it to Alice. We also assume, 
that after the beam splitting Eve is not restricted to any practical way of information 
extraction from this state, thus her potential knowledge is bounded by the Holevo 
information (Holevo 1973). In the general case, the Holevo information x sets the 
upper bound on the information which can be transmitted by a state randomly chosen 
from a set of states pk with a respective probability pk'. 

(N \ ^ 

^Pkpk\ -^PkS{pk), (6) 
fc=l / k=l 

where S{p) is the von Neumann entropy S{p) = — Trplog2p. 
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3.2.1. Direct reconciliation In the direct reconciliation case, Eve has a state ([2]) 
conditioned only on Alice's sent state \ak)- Eve's conditional state is pure, thus her 
information is equal to the von Neumann entropy Iae = S{pe) of her unconditional 

TV 

state pE = ^ J2 Pk- 

k=l 

To calculate S{pe) we need to find the eigenvalues of pe- The rotational symmetry 
of the phase-shift alphabet allows us to write Eve's conditional states in an orthogonal 
basis {|m)} as (Chefies & Barnett 1998): 

N 
m=l 

In the basis Eve's unconditional state takes the diagonal form: 

^ N N 
k=l m=l 

SO Eve's information is equal to Iae = S{pe) = H[C], where H[C] is the Shannon 
entropy (jlj) of the probability distribution C = {|cip,|c2p,...,|cArp}. 

The coefficients |cmP are derived from a system of linear equations enumerated 
by an index k = 1 . . . N: 

N 

J2e'"^''^\cm\' = {eN\ek). (9) 

m=l 

It has a formal analytical solution 

n=l 

where the coefficients Cm depend on the signal amplitude a and the channel 
transmittance rj. 

3.2.2. Reverse reconciliation In the case of reverse reconciliation Eve has a state 
([2]) conditioned on Bob's measured state \(3). After classical communication Eve 
can possibly find out the amount of information ([5]) between Alice and Bob in each 
transmission, so we assume this value is publicly open. Additionally we assume that 
Bob announces the amplitude of the measured state, so Eve knows the measured state 
1/5) up to a cyclic phase shift 271 /N . We denote these possible states as On her 
side. Eve has to distinguish between the states p§ = J^P^iP^^^) kfe) (^fel- 



After averaging. Eve's state is ^ p^ = Pe, so the left entropy term in is 

I 

the same as we calculated before for the case of direct reconciliation. Due to the 2it/N 
phase-shift symmetry of the alphabet, the averaging in the right entropy term in ([6]) is 
just equal to the entropy of any of the states p^'' , let it be the first one p^'' . 

Again, we can rewrite Eve's states \ek) in the orthogonal basis ([7]). 
Unfortunately, the state p^'' in this basis takes a non-diagonal form p^-* = 



k 
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^ Pfc(/3''"^'')cmC*e*i^'^*^'"~"') \m) {n\. We analytically calculate eigenvalues of this state 

k,m,n 

for a given N , but the result is too large to be presented here. Finally, Eve's information 

isIbe{I3) = S[pe\-S[p%\ 

3.3. Postselection 



The key rate G, i.e. the amount of secret information per transmission ([T]), is equal to the 
difference between Bob's and Eve's informations (Devetak & Winter 2005, Renner 2007): 




Figure 1. Reconciliation and postselection areas for 5 letter protocol. Different shades 
of grey correspond to the regions in the phase space where measurement results 
are associated with a given letter. Letters are shown as black circles. Dashed lines 
show the borders of the postselection areas for a case when amplitude is a = 1.4, and 
transmittance varies from 0.95 (the smallest area) to 0.4 (the biggest area) with a step 
0.05. 



In the case of direct reconciliation. Eve has to guess what was sent by Alice. If 
the channel transmittance is lower than 50%, Eve can potentially have a better signal 
than Bob, thus Eve's information can be higher than Bob's information and no secure 
communication is possible. To overcome this "3 dB limit" we use the postselection idea 
(Silberhorn et al. 2002), so that Bob has an information advantage over Eve {Iab > Iae), 
i.e. we select only that part of transmissions which give us positive terms G{(3). 

The postselection procedure in the direct reconciliation scenario can be qualitatively 
described as follows: Eve's information Iae does not depend on Bob's measured state 
/3, so the key rate can be increased if Bob accepts only those transmissions where 13 is 
such that he has higher information than Eve {Iab{i3) > Iae)- Instead of integration 



Coherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying 



8 



over the whole phase space fllip we have integration over the postselected area (PSA): 
Gps= j p{f3){lAB{P)-lAE)d/3. (12) 

PSA 

To find this PSA we numerically solve an equation Iab{P) > Iae- As an example in 
Fig. [1] we show the borders of the PSA for 5 letter protocol as the dashed lines. Different 
dashed lines correspond to different values of transmittance r] = 0.4, 0.45, 0.5, . . . , 0.95, 
and the amplitude is fixed a = 1.4. The PSA is the phase space except the central 
region bounded by a dashed line. If the measured state lies inside the region the 
transmission should be omitted, otherwise it is accepted. The higher the transmittance, 
the smaller the omitted region, the bigger the PSA, and the higher the key rate (fT2|) . 

To find the key rate Gp5 as a function of transmittance rj we optimize the amplitude 
a such as to maximize the key rate Gpsirj) = msixGps{f], a). 

a 

In the case of reverse reconciliation. Eve has to guess Bob's measurement result, 
thus her information cannot be higher than Bob's information: Iab > Ibe- Therefore, 
G(/3) is always nonnegative, and the postselection procedure does not have to be applied. 

4. Results 

The calculated secret key rate Gps{ri) and the optimal amplitude ao^rj) for several 
alphabets are shown in Fig. [j. We can see, that for the channel transmittance rj < 0.9 
all the curves of the key rate are almost the same when the number of letters is more 
than 4. 

In the case of reverse reconciliation we have an interesting result: the higher the 
number of letters, the higher the key rate. We don't have an analytical expression for 
the cxD-letter alphabet, but its approximation by a high number of letter confirms that 
this is the best choice for all values of t]. The key rate is higher than for the 2-letter 
alphabet of almost an order of magnitude. 

In the case of direct reconciliation, we can see that lines G(?7) for various numbers 
of letters are intersecting in different points, which are presented in Table [H This means 
that for different values of transmittance rj there are different optimal numbers of letters. 
The higher the transmittance, the higher the optimal number of states. 

Table 1. Values of transmittance rj, where a curve Gps(-/V, 7y) intersects with a curve 
Gps{N + 1,7^). 



N 


2 


3 


4 


5 


6 


7 8 


V 


0.493 


0.705 


0.797 


0.797 


0.753 


0.725 0.696 



I Discontinuity of the curve 00(77) for the 5-letter alphabet is not a mistake. Due to the fact that the 
function G{a) at a fixed value 77 can have two slightly different global maxima, the exact optimization 
for variable rj may cause a "jump" from one maximum to another. 
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Figure 2. The secret key rate G in logarithmic scale (upper plot) and optimal signal 
amplitude (bottom plot). Solid and dashed lines correspond to direct and reverse 
reconciliation, respectively. 



Again, we don't have have an analytical expression for the curve G{N = oo, rj), but 
we found that left side of the curves quickly saturates (there is no essential difference 
between G{N = 5,r]) and G{N = 64, rj) for rj < 0.9). So we can conjecture, that the 
optimal alphabets can consist of 2, 3, 4, or oo letters. A curve G{N = oo, rj) intersects 
with G{N = 4, rj) at the value rj ^ 0.795, so the most significant advantage of the multi 
letter protocol over the two letter protocol one can get in the case of high transmittance. 
The intuitive explanation is as follows: 

In the case of high losses. Eve has a stronger signal than Bob. Thus the amplitude 
of the signal oq must be small, and Bob relies basically on the postselection. In 
postselection it is harder for Bob to distinguish between many letters than between 
two. Thus with an increasing number of letters his information essentially decreases. In 
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this case the alphabet with two letters outperforms the multi letter alphabet. 

In the opposite case of low losses Eve has a weaker signal, and Alice can increase 
the amplitude of the signal and number of letters. With higher amplitude of the signal 
Bob can better distinguish between many letters and increase his information. In the 
limit 7] — > 1 Alice can use signals with high amplitude and Bob can get almost log2 N 
bit per transmission. Therefore, the more letters in the alphabet are, the higher Bob's 
information is. In principle, one can use an arbitrary high number of letters, and in the 
limit N ^ oo (continuous phase modulation) Bob's information seems to be infinite. 
However, there are limiting factors from both experimental and theoretical viewpoints. 
First, as one can see in Fig. [2]the curves G{ri) and ao(?7) start to essentially increase from 
the values t] > 0.99. In any real experimental setup there are imperfections (inaccuracy, 
losses, etc.), so the case r] > 0.99 can hardly be achieved. Second, any real signal has 
certain energy limit, which sets maximum amplitude. Also taking into account excess 
noise in the channel might somewhat change the situation. 

5. Conclusions 

To summarize, we have presented a new CV QKD protocol with coherent states. The 
protocol employs multi letter phase-shift-keying and heterodyne measurement. Security 
analysis of the proposed protocol is performed for the case of lossy but noiseless quantum 
channels. We have shown that for each given channel transmittance one can find a 
certain optimal number of letters (2, 3, 4, or oo), optimal amphtude of the signal 
(typically, 1 to 4 photons per pulse), and optimal postselection threshold, which increase 
the secret key rate about one order of magnitude comparing to the protocol with binary 
modulation. 
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